Scrypt is Maximally Memory-Hard - <AUTHOR> http://eprint.iacr.org/2016/989 <comment> loup-vaillant Wait a minute, there's a time memory tradeoff attack for scrypt. Argon2 was developed precisely to remedy that problem. And now there's a proof Scrypt is the best anyone can do? This would mean a similar attack is possible on Argon2 as well, even if we haven't found it yet.

This sounds like a _significant_ result, so I'm a bit skeptical right now. Perhaps the paper doesn't mean what I think it means?

<comment><AUTHOR> Time-memory tradeoffs don't reduce the cost, which is determined by the time- area product (or technically the integral of area over time).

<comment> loup-vaillant After you perform the tradeoff, you can still use ASIC to reduce your costs. We regular users only have an x86_64 box. Ideally we want ASIC to be just as expensive.

And by the way I'm not sure time memory tradeoffs doesn't reduce the time area product some don't, but I bet some do (which is why they're called "attacks").

That said, my knowledge is quite sketchy here. Any recommended reading?

<comment> loup-vaillant Perhaps I was not clear. While memory cost about the same in all settings, processing power does not. Whatever part of an attack can be ASICified will be cheaper than it would have been if executed on stock hardware.

Time memory tradeoffs, even if they don't reduce the time-area product, _do_ increase the amount of silicon that can be ASICified. The additional computations might very well cost less than the equivalent memory lookups.

I'd like to close the gap between stock hardware and ASIC. This paper's abstract suggest that we cannot. That's a bummer.

<comment> loup-vaillant Ah, found it. I just had to read the damn paper. Turns out I was confusing memory _hard_ functions, which allow for time/memory tradeoffs, and memory _bound_ functions, which do not.

Scrypt is hard, but not bound. I believe Argon2d attempts to be bound as well. Argon2i however might just be hard, at least in theory, because its memory accesses do not depend on the secrets, making them predictable.

</comment></comment></comment></comment></comment><comment><USER2> The point of scrypt is to utilize the commodity hardware to the max. Commodity hardware gives you a lot of memory IO for the buck. You can't spend the same dollars and get 100x more IO on an ASIC. But you can spend the same dollars and get 100x (actually even more) faster at typical hashes like SHA256.

The point is to cut down on an attacker's possible advantage by using specialized hardware. Scrypt uses memory IO so that you can "get your money's worth" by running it for 100ms on an Intel CPU.

This is old-school thinking and a defensive play at trying to prevent offline attacks. The idea is impose a run-time cost on each attempt to verify a password. Defender spends it every time they try to log someone in. Attacker spends it for every guess at trying to crack a password.

The new approach (well I'm quite biased since I founded a company that does this) is to add a one-time cost which is unbounded and does not impose run- time latency.

We do this with a large amount of random data. Many TBs or perhaps as much as a PB. The salted hashes are entangled with the data pool with a simple API, in such a way that an attacker would need to steal the entire data pool to run an offline attack. Stealing only part of the data pool does not let you crack any passwords, even if they are trivially simple.

The bigger the data pool, the easier it is to defend, and the faster the system runs and more hashes/second it supports. So, is essence it's high performance scalable security that actually stops offline attacks even after the site is breached.

You use this new approach as an additive layer on top of the existing scrypt hashing that you are already doing.

<comment><USER3> I'm intrigued.

Do you have a link or something that I can read more about the "new approach" as you say?

<comment><USER4> [https://taplink.co/technology/](https://taplink.co/technology/)

<comment><USER5> This is snake oil. You are just doing 4 additional HMAC salts and pretending the data is more secure. This doesn't give you any additional security.

         H1 = HMAC(Salt1, Password)
         H2 = HMAC(Salt2, H1)
         ---send to Company---
         H3 = HMAC(Salt2, H2)
         H4 = HMAC(Salt3, H3)
         ---send back to customer---
         Compare H4 with known value

Ref to technical white paper: [https://taplink.co/wp- content/uploads/2016/10/TapLink_Blind_...](https://taplink.co/wp- content/uploads/2016/10/TapLink_Blind_Hashing_Whitepaper.pdf) (I'm treating the AppID as a Hash, as I'm ignore the look up stage for the _massive_ salt).

Effectively your process can be described as:

         Hash = HMAC( Salt3, HMAC( Salt2, HMAC( Salt2, HMAC( Salt1, Password))))

But with network transmission?!?!

Multiple salts != more security

[https://stackoverflow.com/questions/12753062/multiple- salts-...](https://stackoverflow.com/questions/12753062/multiple-salts-to- protect-passwords)

[https://programmers.stackexchange.com/questions/115406/is- it...](https://programmers.stackexchange.com/questions/115406/is-it-more- secure-to-hash-a-password-multiple-times)

Also the step of shipping the final hash back to the customer is SO dangerous. TLS/SSH is _secure_ but one miss-configuration/bug/0-day and you leak dozens of credentials.

This is a really stupid model. Furthermore salts larger then the final output side offer no additional security. If you have 256bits of output, you only need 256nits of input. Larger inputs technically risk reducing the entropy of the final output.

This whole security model assumes taplink.co will never get MITM. This can't be guaranteed. This also means your whole system goes down when taplink.co is out.

<comment><USER2> That's a lot to respond to at once. :-)

I will say it's important to understand _how_ the Salt we return is generated. We use a massive pool of data as effectively the internal state of a hashing function. This means you need all the data in order to perform the same calculation.

The value sent to us is just the hash of a salted hash. By itself it is useless. The value we return is Salt2 -- also useless on its own. This is very purposeful. If the TLS channel is owned, nothing of value is lost. The Salt1 is still private on the site's server, and no passwords can be cracked without it.

Availability is a legitimate concern. Similar to SMS multifactor, this is an added 3rd party dependency. We direct peer to many of our customers and route over private IP space to avoid a potential DDoS.

<comment><USER5>
          I will say it's important to understand how the Salt we return is generated.

Not in the slightest. It is the HASH of a HASH of a HASH. There is no academic rigor to support this gives you any additional security. And a lot of academic rigor that states it is a moot operation.

          The Salt1 is still private on the site's server, and no passwords can be cracked without it.

1) If you argue any SALT is private... Then WHY EVEN USE SALTS?!?! If something on the database is private/secure why not use clear text passwords? The whole idea of using SALT+HMAC is that NOTHING stored is private/secure. You cannot EVER assume SALT(s) are private.

2) Cracking the password is irrelevant. All that is needed is:

          SALT2 + Web transferred hash

Then the credentials are gained. Yes learning somebody's password, or several million's peoples password is a fun experiment but gaining access to the website is also an attack vector, one your system is making easier.

For a traditional HMAC/Scrypt/Bcrypt recovering the password is a critical part of this as the authentication mechanism is a single black box program. Input is SALT+Password+Hash. Output is an auth token.

The system you describes breaks this dichotomy. No longer must the password be broken to gain access.

:.:.:

           Availability is a legitimate concern

An extreme one

           Similar to SMS multifactor

SMS Multi-factor is depreciated. Faking SMS from an arbitrary phone number is extremely trivial in practice. Look into Dave Kennedy's work on social engineering.

Multi-Factor auth is best done via Tokens or TOTP.

           We direct peer to many of our customers and route over private IP space to avoid a potential DDoS.

So instead you want to just install your own box on the customers network? This opens up even more headaches about managing and authenticating your access to their private LAN. Then you get into patching agreements, possible OS limitations, security audits. This is a horrible solution for both parties.

<comment><USER2> I'm sorry if I'm not explaining it right, there's definitely something lost in transmission here.

We are keying the hash (HMAC), keyed by a value derived from the data pool. Please don't take the 4 line pseudo-code too literally.

The value stored in the database (Hash2) can only be used to verify a password if you can also complete the blind hash which is blinded by the data pool.

I can say, this approach has been vetted by both well known cryptographers (Solar Designer, Scoob) as Passwords^15 as well as industry crypto wonks at MITRE and elsewhere. It's certainly not snake oil.

The salt kept on the site's server means that the site must be breached in order for a successful attack to be mounted. It's why we call this a fully additive layer of security. You need the Salt from the site, and the entire data pool from us, to mount an offline attack.

2) Why would you say that? It's absolutely not the case that you can login with Hash1 and Salt2.

If you intercept Hash1 and Salt2 then you may know Hash2 but you still cannot login, and you cannot try to crack it without Salt1. Again, this is all assuming TLS is broken in which case you can just inject your own JavaScript onto the page and steal passwords in clear text.

By direct peering I mean programs such as AWS DirectConnect which gives us 10Gbps on their network and private IP access to our peers. Nothing to get too excited about.

I'll be back online in about an hour if this still doesn't answer the basic questions around the security of the construct.

EDIT: I do not mean to say solardiz or sc00bz have personally endorsed our product. Only that we have all worked on and published write ups on the same general approach (using large data pools with bounded network links) to solve the password security problem.

<comment><USER6> While security does not rely on simplicity, a simple system is much easier to reason about security. What you add is a whole stack of complexity through multiple hashes, entropy generation (on your end), and network transport (TLS).

There's no way you could convince me to use your system over a basic KDF implementation. The only people you're going to convince to use this protocol is someone who doesn't have experience in the field, which is why I'd consider your solution snake oil.

<comment><USER2> I've talked to many cryptographers in the field. Universally they _appreciate_ the solution for its simplicity. We don't use any new crypto - the whole construct is based on a CS-PRNG, hashing and HMAC.

You talk to this service just like you talk to any service over the LAN or WAN. Through an encrypted channel. Goes are the days when you can just dispatch a request over the LAN and assume you're good. We are happy to setup dedicated machines with spiped as we are using TLS.

But certainly you look at solutions like CloudFlare or even dare I say Firebase, and the industry has moved far beyond your level of paranoia.

I don't want you to use it instead of your basic KDF, but in addition to / after your KDF.

13 million Americans had over $15 Billion stolen last year in cyber-heists and almost 70% of those attacks were using a stolen password. The basic KDF is not working, and it's time to stop blaming the user for not having 69 bits of entropy on their password and start giving companies the tech they need to actually secure their passwords.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> It's worth noting that an issue with scrypt for proof-of-work cryptocurrencies is that is is expensive to check. The ideal problem is memory hard to solve but can be checked cheaply. This is what equihash (used by zcash, ([https://www.internetsociety.org/sites/default/files/blogs- me...](https://www.internetsociety.org/sites/default/files/blogs- media/equihash-asymmetric-proof-of-work-based-generalized-birthday- problem.pdf)) attempts to do, though proving the memory hardness seems more harduous than in the case of scrypt.

<comment><USER2> Is this really a major pain point? You have to run billions of units of the work to find the proof. You run exactly one unit of the work to validate the proof.

The units can be set somewhat arbitrarily. Although it is important for the unit to be memory-hard-enough to not accelerate well on a GPU.

I would think that's a rather wide "target" which can be hit by scrypt at a certain difficulty.

Needless to say, it's still possible to get it wrong, e.g. Litecoin.

<comment><USER8> There's something to be said for both. It's true that there is a scaling intrinsic to the Bitcoin protocol (which it had to have, as it was based on fast functions) to allow arbitrary slowdown at the brute-force level. However ideally it would be nice to have an asymmetry there.

Just think of it purely in the manner of "why run exactly one unit of the work? why not run a hundredth of that unit to validate the proof?" An asymmetry allows you to more quickly verify the ledger, which is both a startup cost and a lesser ongoing cost for everyone.

I'm wondering however if there is a connection with asymmetric encryption, though. Imagine a one-way function h and two functions f(x), g(x) such that f(g(x)) = x. Suppose the task is "find M such that g(h(M)) lies within some narrow subset," then if g is much slower than f, you can verify a pair (M, g_h_M) not by verifying that g(h(M)) = M (slow) but rather by verifying that f(g_h_M) = h(M) (much faster). The importance of h is just that for the most obvious application (f(x) = x^E modulo N, g(x) = x^D modulo N), you also have that g(f(x)) = x, and this is a relatively common property of inverse functions.

<comment><USER7> You get the same properties with a basic proof of work scheme. The difficulty would be to make g memory hard and f not memory hard.

</comment></comment></comment></comment><comment> todd-davies When we talk about the term 'computationally hard', we usually mean an NP-hard problem. I assume that here, 'memory-hard' means that no other hashing algorithm can have a greater lower bound on its memory complexity than Scrypt. Is that correct?

Edit: After a re-read, I realised that the answer is in the text:

"Memory-hard functions (MHFs) are hash algorithms whose evaluation cost is dominated by memory cost."

</comment><comment><USER9> I was under the impression that there were scrypt ASICS. Can someone explain how, if true, this is compatible with this claim?

<comment><USER10> For some reason Dogecoin, Litecoin, and all the other scrypt-based cryptocurrencies use extremely low N and r parameters, such that computing a hash only needs 128K of memory.

<comment><USER11> Maybe using a harder hash does not incentivize people mining it, reducing its growth and liquidity?

<comment><USER12> I'm under the impression that the Litecoin creators thought that scrypt would prevent ASIC miners, but they still wanted to be able to GPU mine, so they used low difficulty parameters. Which of course led to ASIC miners being implemented. Then Dogecoin just copied Litecoin directly.

<comment><USER13> > thought that scrypt would prevent ASIC miners,

I'm still amazed that people believed that.

We've been pushing general purpose CPU's for decades because there is nothing novel or hard about making single purpose processors.

I didn't realize you could just say random computing terms and people would believe you. "This is memory hard so therefore no ASIC (single purpose processor) could be made because memory is expensive"

I like cryptocurrency but 2012-2014 was seriously like being on crazy pills listening to the fans.

<comment><USER14> To be fair, memory hardness is a legitimate concept with proofs and everything; Litecoin just made a mistake in their design. ZCash is giving it a second try, taking into account improvements that have been made over the last few years.

</comment></comment></comment></comment></comment></comment><comment><USER15> at [https://hashcash.io/](https://hashcash.io/) I am using litecoin hashing algo, which in turn uses scrypt.</comment>


Terry Callier, Singer and Songwriter (and Programmer), Dies at 67 - <AUTHOR> http://www.nytimes.com/2012/10/31/arts/music/terry-callier-singer-and-songwriter-dies-at-67.html

<comment><USER2> I didn't know he was a programmer.

I discovered him in 1995 on a mixtape (by Tom Simonian Thump) a friend brought back from San Francisco the year before. "Dancing Girl" was an incredible piece and it still gives me goose bumps every time I hear it.

That song was a shock for me and another friend: we were both into crate digging and we spent countless and fruitless days looking for anything by Terry Callier. At the time, _nobody_ knew about that guy here in France and it took years until we found anything. Until he did a come back in the early 00's.

</comment><comment><USER3> Seek out 'The New Folk Sound of Terry Callier'. Spare production, strong and haunting voice. These recordings are more than 45 years old and sound like they could have been made yesterday.

<comment><USER4> +1 and check out 'What Color is Love'

great talent and will be sorely missed...</comment></comment>


Ask HN: Is HN slow for anyone else? - <AUTHOR>

I have noticed that the response times of HN has been rather high today, anyone else having the same experience? <comment><USER2> Yes. It is very slow. This happens.

</comment><comment><USER3> Yup</comment>


Ask HN: What are you using for personal knowledge management? - <AUTHOR> Hey folks,
With so many tools and one-off approaches being shared for knowledge management, I would be curious to learn from you - what is YOUR approach?
I've been trying to use several note-taking apps and even using paper, but none quite fit for a system that should tie in together a bunch of different asset types (notes, handwritten content, book summaries, images, videos, etc.) in a cohesive manner, and allow for efficient recall. <comment><USER2> Evernote and Pinboard.in

</comment><comment><USER3> github gist and notion.</comment>


Adds support for Canadian programming conventions to the Ruby language - <AUTHOR> https://github.com/vanruby/canada

<comment><USER2> typedef UIColor UIColour;

alias mroe more # This was the default on ucscb.ucsc.edu!</comment>


Sqitch - Sane database change management - <AUTHOR> http://sqitch.org/ <comment><USER2> I used to use sqitch. It drive me mad, it wants to do too much. I have got for version control, I don't need sqitch to do it as well. And it doesn't play nice with other developers. If you add migration a in one branch, and someone adds migration b in another, then they merge theirs before yours, you're in for a world of pain whne you try to delpoy yours.

In the end I wrote a replacement that did was I needed in under 100 lines of perl. DB management should be simple. No point over complicating it

Not forgetting the guy who writes it is not that friendly, we sent a patch to change the default answer to revert to no, instead of yes. First off he said it was useless, then after some prodding over several months he copied it in and committed it in his name, no mention of where it came from. Real classy

<comment><USER3> Are there other database migration systems that make dealing with migrations in conflicting branches really easy?

<comment><USER4> It's been my experience that simpler is better. At least when it comes to teams up to around 12-15 people. After that politics will dictate how you migrate.

Adopting three rules has pretty much made migrations a non issue: 1. migrations should be timestamped, tracked, and applied in time order (rails- style migrations; this allows for the migrator to determine which migrations have not been applied regardless of when they get added to the run list) 2. migrations should be committed separate from logic changes (this way you can bring in migration a if migration b depends on it even when feature a isn't ready to be merged) 3) migrations are always forward. It's great to be able to revert during development but production is always forward. If a migration fails it always requires investigation; there is no automatic recovery.

Using the above rules you can put together a migration system in any language in about an hour by simply storing files that issue DDL/SQL directly. With a few hours more work you can abstract it out and be cross-database but that's rarely worth it.

I've tried sequentially versioned migrations and they are a major bear to work with when branching and multiple developers are involved. You end up having one guy be the "database migration guy" and responsible for keeping everything in order.

The intelligent migrators that do diffs of the schema vs the db always have issues plus the very real potential to lose data.

<comment><USER5> We actually use rails just to manage our db. Rails migrations are so good and sane (including the rake generator tasks) that I highly recommend it...even if you are using nodejs or something else as your actual stack.

<comment><USER4> That's a great idea. I never would have considered that.

Do you create a full rails project to handle migrations or what? How do you integrate that in with your other code?

<comment><USER6> I've used [https://github.com/thuss/standalone- migrations](https://github.com/thuss/standalone-migrations) with success before. It's the rails migration system as a standalone gem.

</comment></comment></comment></comment></comment></comment><comment><USER7> So far Sqitch has been an absolute nightmare for production deployments, particularly if you have to change something in history before a tag occurs. Not to mention merging, which invariably always generates a conflict in the plan file.

</comment><comment><USER8> We're currently looking at [http://flywaydb.org/](http://flywaydb.org/). Does anyone care to share some expiriences?

<comment><USER9> Especially if your build involves Maven, FlywayDB is a very good choice if you want to use native SQL to manage your schema.

I was originally quite bullish on FlywayDB until I started looking into Liquibase by way of Dropwizard. I'm personally not quite convinced of the need for native SQL scripting for schema management, as I often like to work in H2 for dev and something else for production.

However, if you primarily want to use JDBC + native SQL to manage your schema, Flyway is quite powerful and easy to fold into your build process.

</comment></comment><comment><USER10> Nice, it feel similar to how Yii does database migrations but with a lot more packed in.

What I'd really like to see is a open source or free tool accomplishing similar things to what RedGate SQL Compare does. Now that's a powerful tool and certainly worth its cost, but in some situations a limited option due to its support for only SQL Server or where funds are lacking.

<comment><USER11> What I'd like to see is a portable Data Dude (a.k.a. Visual Studio Data Projects). You basically write your database as a whole bunch of CREATE scripts, Data Dude then does a full parse over that (with all the static compilation bells and whistles - including some static analysis), diffs it against your actual DB (or a previous version, if you keep the 'libs' around) and then spits out the relevant diff script. Obviously you'll sometimes you need to manually pre-script/post-script to upgrade data.

It basically makes database dev behave exactly like your average imperative language. The current mainstream DB landscape is ridiculously absurd. We don't write migrations for our C++, so why the heck are we writing migrations for our DBs? We the heck are we committing history (migrations) into a stores that is already historical (SCM)?

<comment><USER12> If I read you correctly (quite possibly not) you're proposing something like the output of "mysqldump -d" be compared to some golden schema dump and then implement something like RANCID for routers such that changes in the DB schema get emailed or otherwise loudly announced and tracked vs the golden schema. I do that. A very small shell script can take care of irrelevant diff outputs (timestamps and default minimum autoincrement numbers the like)

On a side issue (kind of), something not covered in the squitch tutorial is if you git-flow then you probably should lay down some discipline that the exact name of your feature branch is the squitch change name, just to keep insanity levels down. Also I've done things like a git-flow feature branch results in a completely new test table name being created and there needs to be discipline that the test table name is "normalTableName-gitflowFeatureBranchName" or some kind of site standard. Its only kind of a side issue, in that your proposed Data Dude app probably should cooperate with git-flow workflows.

> so why the heck are we writing migrations for our DBs

Sometimes dumb indexing decisions can take hours / days to apply and kill the NAS, run the system out of storage, etc. I've done that and its not entertaining, so its less painful to do "real stuff" by hand, at least to production machines. Tend to find some hilarious scaling mistakes. Very few source code diffs scale the source code length itself exponentially or something equally naughty so its always safe to commit/pull source code changes and automerge them, not so much schema changes.

<comment><USER11> > Very few source code diffs scale the source code length itself exponentially > or something equally naughty so its always safe to commit/pull source code > changes and automerge them, not so much schema changes.

Awesome counterargument. However, in the same breath: what's the story with migrations? In RoR they're ordered by date, so what happens if two developers make concurrent and conflicting schema changes in their respective branches? That merge will silently fail, a false positive. At least a merge conflict throws up red flags, causing some human has to look at what is going on.

</comment></comment></comment></comment><comment><USER13> Squitch looks interesting, but I can't figure out how to use it to make production deployments.

In some environments, you can play with your dev and test environment, but the production is someone else's playground, and you just have to give them set of sql scripts to deploy.

Can something like that be done with squitch?

<comment><USER14> I might be missing something, but all the code being executed just seems to be running some .sql files on the database (deploy/ _.sql, revert /_.sql, verify/*.sql). It seems to just be an interface to loading these sql files, making it easier to (for example) revert a set of changes in order.

So, you could just use this tool to manage and test your chances, and then manually go through and give instructions to prod engineers on which files to deploy and how.

Git does seem to be complicating things, though.

</comment></comment><comment><USER15> In the PostgreSQL world, there are extensions ([http://www.postgresql.org/docs/9.4/static/extend- extensions....](http://www.postgresql.org/docs/9.4/static/extend- extensions.html)). Since extensions are self-contained groups of database objects (i.e., code), are versioned and have some (basic) form of dependency management, they can be used for simple deployment mechanisms. They also support "SQL diffs" as "migration scripts" from version to version, and the extension mechanism applies them as needed. With all this, ot is not difficult to build a simple infrastructure for code packaging and deployment. That's what we do in our company.

<comment><AUTHOR> Would love to see a blog post detailing this.

<comment><USER15> Hmmmmmmm ok, good idea. Adding to our TODO list, hope to get it out soon ;P

</comment></comment></comment><comment><USER16> We're in the midst of adopting Liquibase to support our schema on 3 different db's (Oracle, SQL Server, MySQL). Interested in hearing about any experiences or gotchas with this tool.

<comment><USER17> I have been using it for the last five or so years and absolutely love it. I would recommend that you:

\- Make sure every code feature gets its own Liquibase migration file

\- Use the XML format—stronger IDE integration, and it's been around longer

\- If possible, use their migrations instead of raw SQL, since you will get the rollback functionality "for free."

\- Integrate it with the "deploy" phase of your Maven build, if applicable

\- Use the "reverse engineer" feature when you get close to deploying it the first time, to ensure that you have a from-scratch workflow that works and produces identical schemas

You will get merge conflicts on the file that lists the migrations to apply, but they are obvious and trivial to fix.

Pitfalls. The only one I've noticed is that it can be confused about Postgres types, but I have been able to the "rewrite" functionality to "fix them in post." I tried the YAML format and found that I missed the completion in the IDE that the XML format has, thanks to the schema. Otherwise, it works fine, but I like the validity angle.

You can set up some migrations to be run every time. I usually set up the GRANTs that way, so I know the permissions are good right before a code deploy. Also, on those migrations, use an empty <rollback> clause so it doesn't prevent you from rolling back (you can do that on any migration to make Liquibase ignore it during a rollback operation, so all my data- manipulation migrations get one too).

</comment></comment><comment><USER18> I tried to use it. But it was too cumbersome to manage my migrations this way. I love the way that Rails handles database migrations.

</comment><comment><USER19> I tried to use it once. It looked promising, but i remember I had some problems with testing migrations.

</comment><comment><USER20> I really prefer git + Liquibase. I personally like the database abstraction and the refactorings.</comment>


Announcing the first Racket Days - <AUTHOR> http://lists.racket-lang.org/users/archive/2011-March/044774.html

<comment><USER2> Is this event also open to "dabblers"? I would happily fly out from Cali to participate in that event.

<comment><USER3> Based on my reading it is.

> It will be an opportunity for developers, researchers, and educators using > Racket, DrRacket, Program By Design, and related technologies to come > together to share plans, ideas, and enthusiasm.

The _related technologies_ part, combined with the _plans, ideas, and enthusiasm_ sound pretty inviting to me.

I hope you'll find time to do something substantial in the four months between now and the conference. I'm hoping to as well, should I decide to pursue this.

<comment><USER2> I'm primarily a Python/Pyramid (web)programmer but have been wanting to experiment more fully with Racket/Scheme in that regard - I think I'll try throwing something together for the event...

</comment></comment></comment><comment><USER4> This has to be one of the biggest perks to being a Northeastern student. See some of you there!

</comment><comment><USER5> This looks good. I'm already thinking of presentation topics.</comment>


How the Singapore Circle Line rogue train was caught with data - <AUTHOR> https://blog.data.gov.sg/how-we-caught-the-circle-line-rogue-train-with-data-79405c86ab6a#.qjsiufjb7 <comment><USER3> This is going straight into my favourite bug-hunting stories, along with the 500-Mile Email: [https://www.ibiblio.org/harris/500milemail.html](https://www.ibiblio.org/harris/500milemail.html)

<comment><USER4> Have fun: [http://beza1e1.tuxen.de/lore/](http://beza1e1.tuxen.de/lore/)

<comment><USER5> Now that is a great collection, thank you!

One thing that I think would make the collection even better is spoiler free titles to maximize the suspense.

For example, the screen saver story lost much excitement when I knew the cause from the title.

<comment><USER4> Good point. I changed a few. Thanks for the note.

</comment></comment></comment></comment><comment><USER6> When I interview developers, I like to ask them about their favorite bug. I want to hear a story. Most people have a good one. It's usually intermittent, hard to track down, and takes a long time to solve. It becomes a developer's nemesis, taking on an identity. The relief, when it gets solved, is huge. Good developers tend to talk about such bugs with passion.

This story is a beautiful example of such a story. Great read, great bug, great analysis!

<comment><USER7> One of my personal favourites.

Years ago I worked on a stock control system for a popular clothes retailer. Where previously store managers had to spend hours on the phone ringing the depots to see what was in stock and reordering popular lines, now they could fill in orders an they would be emailed to the depots in machine readable format, with the order balanced across multiple depots depending on availability of stock.

After the system had been in operation for a year or so, managers started to complain that some orders weren't turning up. After a bit of digging it only seemed to affect one particular depot, but I couldn't initially see a common factor between the orders. It had nothing to do with the size of the mail, or the originating store. I could tell from the logs the emails were being formatted and supposedly sent to the depot, yet they never translated into orders. The system would silently fail after we'd handed the email to the depot with no obvious reason why.

So I wrote a quick script to collect all the orders for a day from all the stores and compile a list of all product lines that were present in the orders that went missing, but not present in the orders that succeeded, just to see if there was a pattern. This turned up a few dozen items and after a quick visual scan of the product descriptions one stood out slightly, so I phoned the depot on a hunch.

The depot had an anti-spam filter on incoming emails that silently dropped messages with pornographic words in the body or any attachments. The retailer had just received a new seasonal product line, which was selling well, and the product description was "bondage tights".

After getting the depot to whitelist emails from our system, orders for this product line started working.

<comment><USER8> We ran into a similar but much easier to identify problem with PayPal - <USER2> products we sold containing the words "Cuba" or "Havana" in their title or metadata, regardless of the context, would cause PayPal to reject the entire payment with a meaningless error and no indication of what had caused the problem.

PayPal refused to admit to us that this was the cause and insisted they couldn't shed any further light on the issue despite the fact we could trigger it 100% of the time.

In the last few weeks it's started randomly choking on the word "Pharaoh", God knows why, and God knows why it only does so about half the time, but I'm not going to bother asking PayPal about it.

<comment><USER9> Fraud detection and compliance systems have a false positive rate, unfortunately. And a company confirming something like that would be tantamount to telling how to avoid the filter, which also raises their false negative rate, which is not in the company's interest, whether the party in question is a fraudster using it for their own interest or a non-fraudster that spills the beans on HN.

But yeah, it sucks that their system can't learn to give you an exception after it has been reviewed once or twice.

</comment></comment></comment></comment><comment><USER10> I hope they do a followup about what kind of problem they found in PV46.

I suspect that someone flipped the switch away from "More Magic" :)

[http://catb.org/esr/jargon/html/magic- story.html](http://catb.org/esr/jargon/html/magic-story.html)

<comment><USER11> I've been caught out by "ground" not really being ground before; two different sides of a whole floor computer / comms centre had different potentials. So most of the power was hooked up to ground on one side of the building and a small number of non computer / comms gear was hooked up to ground on the other side (think lights etc that were too difficult to rewire), but the other gear used wall sockets that were a different colour to make sure people didn't plug computers or network gear into them. This was all discovered after a temporary 20V spike difference in the different grounds trashed an expensive router. The electricians suspected that because we used a largish number of microwave links on the building the copper bars that run down the building to ground were acting like antennas and picking up the energy. So we defaulted all the sensitive gear to the "ground" that was least problematic. It was cheaper than re-doing all the ground circuits in the building with RF shielding. The joys of old buildings.

<comment><USER12> A popular train line out of London has an electrical problem like this with one of the train models run upon it. Whenever these trains, travelling about about 100mph, cross from one power section to the next with the front the train entering one, and the rear leaving the other, there is some weird electrical event that causes a safety mechanism to violently retract the rear pantograph[1] (maybe more than one). This causes an almighty _WHACK_ on the roof which scares the bejesus out of any visitors not used to impact noise. I've seen at least one coffee ejected from a cup onto someones trousers because of this. The train progresses unharmed.

[1] [https://en.wikipedia.org/wiki/Pantograph_(transport)](https://en.wikipedia.org/wiki/Pantograph_\(transport\))

<comment><USER13> Are you sure this isn't just the pantograph passing through the neutral section? They have these on long runs where the power is supplied from different sources (resulting in sync issues). There are circuit breakers at these points which on some trains makes a very loud 'clunk', which stops the train trying to draw current through . The other type of 'clunk' you get on some trains (although not the ones you are describing) is the pant going up/down on combined AC/DC lines.

<comment><USER12> It could be circuit breakers, yes. They would need to be big devices, though. It is very loud. Best I can come up with is someone dropping a shopping trolley on the roof from a storey or two high. I got the pantograph information from a rather "train-nerd-I-love-my-job!" sounding driver over the tannoy one evening perhaps two years ago. I may have misheard!

<comment><USER14> They are the circuit breakers. Our trains in Brisbane, AU run 25kV (Thameslink seems to be the same 25kV overhead, with a 750V third rail, but this will be the overhead section) and the circuit breakers trip during the entry/exit of a neutral section, causing an almighty bang as they kick out and back in. If you're sitting in the wrong carriage directly underneath them it's very loud.

For reference, 1kV arcs across about 1cm of air, so 25kV needs a full foot of space in air (obviously less with a dielectric, but you get the orders of magnitude).

Source: I design trains for a living, though on the mechanical side

</comment></comment></comment></comment></comment></comment><comment><USER15> Damn that was exciting.

From the bottom of the linked press release, which summarizes the overall investigation:

"In particular, I thank the engineers and data scientists from DSTA and GovTech respectively, without whom we would not have been able to theorise the possibility of a faulty train, and identify PV46."

A "steely eyed missile man" moment. [https://en.wikipedia.org/wiki/John_Aaron](https://en.wikipedia.org/wiki/John_Aaron)

</comment><comment><USER14> This is fantastic. I was in Singapore a couple of weeks ago and after mentioning that I'd narrowly missed out on getting an SMRT job earlier this year we got talking about the SMRT in general. He commented on this exact phenomenon of emergency braking for 'no reason', saying that the people of Singapore were losing faith in SMRT and their ability to keep up the reliability of the network after a spate of these issues due to 'interference'.

It's truly wonderful to see how they went about identifying the problem. This is fantastic work and the team deserves major kudos for nailing this.

</comment><comment><USER16> Not trying to be too negative here, but why wasn't a broad association analysis done on this dataset first? The number of outages correlated with train activity should have popped up like a sore thumb, no? Hindsight is always twenty-twenty, but I feel the author just wanted to show of his cool visualization knowledge, while the same could have been achieved with a much more boring association table.

EDIT: I am corrected by "Rifu". Activity data of all traincars was not available in the first instance, so a broad association analysis would probably have yielded nothing. The type of analysis the authors use seems warranted. Although I'd still recommend doing broad association analysis on any dataset, before moving into complicated visualization techniques.

<comment><USER17> As per TFA, they did say that the only data they had on hand were from the trains that broke down, so it would have been impossible to even detect the "rogue train" from a simple analysis of the data they had. Though it also said SMRT was slowly extracting the train logs from the incidents so I'm sure they would have gone with that if their preliminary analysis yielded nothing.

<comment><USER16> Right I overlooked this. That makes it more meaningful to do the analysis as in the article. I stand corrected.

</comment></comment></comment><comment><USER18> I was expecting something more like the 'A Subway Named Mobius' short story [1] - it's one of my favourite topology related bits of SF - OK, possibly the _only_ topology related SF?

1\. [http://www.rioranchomathcamp.com/Topology/SubwayNamedMobius....](http://www.rioranchomathcamp.com/Topology/SubwayNamedMobius.pdf)

</comment><comment><USER19> That's a really great analysis, almost feels like a detective story .)

OT: I am a huge fan of Python, so whenever I see Python helps to solve a thing I always say myself "yay Python!"

</comment><comment><USER20> ARGH! What hardware problems on train X can cause train Y to go into emergency braking mode? Curious minds want to know.

<comment><USER14> Wireless signalling transmissions, EM interference, at two guesses.

<comment><USER21> Yep. Singapore Circle Line is a CBTC (Communication Based Train Control). Trains receive their movement authority through wireless transmission. If due to interferences the transmission is interrupted for more than some seconds, then movement authority expires and the on-board systems will bring the train to a stop through safe measures (typically, application of emergency brakes). It is quite common to have interference issues due to some geographical problem (e.g. incorrect installation of access point antenna) but much less common to have a jammer train. It is also quite impressive that the jamming would be long and wide enough to exhaust all the redundancies put into such system.

</comment></comment></comment><comment><USER22> But what actually caused the interference? Never been blueballed so had by and article.

<comment><USER23> faulty signalling hardware on the rogue train

[http://www.straitstimes.com/singapore/transport/mystery- of-c...](http://www.straitstimes.com/singapore/transport/mystery-of-circle- lines-signalling-woes-solved-train-with-faulty-signalling)

</comment></comment><comment><USER24> Super cool to see how the team isolated the cause. I travel along the same route as well and this train caused half the circle line to be shut down during one morning.

For the next few days after, they shut down the telco signals in the train tunnels to determine if it caused the signal interference.

</comment><comment><USER25> Impressive work by Singapore government agency. I heard that they are as competent as private sector.

<comment><USER26> Since moving to the US, my health insurance is handled by the private sector. Competent is not how I would describe it. (The more accurate term is 'Kafka- esque')

Back in Canada, on the other hand...

<comment><USER27> The incompetence of government is a matter of religious faith among some people in the US, logic and empirical evidence be damned.

</comment></comment></comment><comment><USER28> The parallel with epidemiology is striking. And I keep on being amazed by the power of the visualization of data. The problem began to unravel when they "zoomed in" on a pattern that was not clearly visible initially.

</comment><comment><USER29> Wow what a digital Sherlock Holmes tale! Beautiful story. Incredibly hard if the data was not visualized that way. I learnt some good things. Thanks for sharing here!

</comment><comment><USER27> Good work, though I can't help thinking that a defective train could just as easily have been caught through performing regular maintenance. Rolling stock and other physical things are subject to both manufacturing defects and wear.

I wonder why the rail managers allowed the defects to inconvenience passengers for so long instead of rethinking their maintenance procedures.

<comment><USER30> The defective train worked perfectly. It was the other trains that failed due to the radio emissions the rogue transmitted.

Not obvious.

</comment></comment><comment><USER31> I wonder if some "AI Gen 3.0" machine learning / cognitive machine system could have caught this, without human intervention?

I just yesterday attended a presentation by a ex NSA guy (who's of course pitching his company Adatos, so grain of salt) who claims you could feed the raw data in and the pattern will be found.

</comment><comment><USER32> Reminds me of a 1996 Argentine science fiction film called "Moebius" which involves a missing train, topology, the Dirty War, and of course Borges.

[https://en.wikipedia.org/wiki/Moebius_%281996_film%29](https://en.wikipedia.org/wiki/Moebius_%281996_film%29)

</comment><comment><USER33> Dunno. About 2 paragraphs in, "oncoming trains" was the first thing that popped into my head.

</comment><comment><USER34> Nice write up.

As a side note, I find alarming the fact that the blog of the _Data Science Division_ of a government (any gov) is hosted on a third party provider.

These guys look like they know what they're doing though, so I guess it was a weighted decision.

<comment><USER35> do you find it alarming that governments (including the US) use official twitter and facebook accounts? Why should this be any different?

</comment></comment><comment><USER36> This makes me excited about data science

</comment><comment><USER37> Never heard of Jupyter Notebook until this story. It reminds me of Eve.

<comment><USER38> You may have heard its previous name being used - iPython notebook. FWIW it took me a year plus to actually start using the name Jupyter. Wasn't until one of my students asked me why I kept saying "iPython" when the tab says "Jupyter"

</comment></comment><comment><USER39> code snippets not displaying?

EDIT: Great article and good problem solving skills

<comment><USER40> They're hosted by github, does the main site load for you?

</comment></comment><comment><USER41> TLDR; There was a single train emitting both correct and erroneous signals. This caused trains in the vicinity to lose data link which triggered an emergency brake safety feature. The article doesn't make clear what medium the trains communicate on which was affected (e.g. rail, wireless, powerline). They have not yet determined what caused the faulty hardware (or software???) on the faulty train to enter this state.

<comment><USER42> Think you're looking at this story the wrong way; Its not about the fault but the bug hunting process.

I propose:

 _TL:DR - They had a strange hard to identify bug, but used a limited data set and interesting techniques to quickly find the esoteric cause of the problem._

<comment><USER43> imho his TL;DR is better than yours, but your improvements could be made to his. In my education we was taught that in science and business, the abstracts should tell the whole point of the story; the "spoiler" should not be saved till the end even though that makes for more fun; this is to allow a busy person to get the takeaway quickly and assess if they need to read all the detail. Whether anybody agrees with that or not, it's been burned into my way of looking at the world, so even when reading this article, all the way through I was gritting my teeth thinking "I wish I had some clue as to what I'm reading about."

so to add in your point, to his TL;DR I would put in "the intial dataset included only the trains that had suffered the fault, but as the fault was caused by a functioning train, a more comprehensive dataset was necessary to find the problem; had it been provided initially, less detective work might have been necessary"

</comment></comment></comment><comment><USER44> Wow!!! Super impressive.</comment>


Ask HN: How much would I give away on fundraising? - <AUTHOR>

I have a solid near-finished product in a new market with a lot of potential interest but no customers just yet.
I estimate the company and product to have around 1M - 2M value. How much would I have to give away from the company if I raised 500K? How much control would I lose of the company? Would I have to report to a board of directors?
I know I only gave rough figures, but I would be interested to even have rough answers. <comment><USER2> The valuation fundraising question is a really really hard one. Tons of ways to go about it, but here's how I like to think about it:

1) Total up your monthly burn rate (include a 20% premium for shit happens expenses) for the bootstrapped seed stage <= 300k works for most. Multiply that by a range of 9-12 months. The 9 month period is the lower bound of what you raise and the 12 month period is the upper bound of what you raise.

2) Hopefully you can give up <= 10% of the company. It depends on a per company basis. Try to find someone to lead the round at that valuation. If someone leads at that valuation, it's easier to get others in line.

3) Your goal over the next 9-12 months should be to knock it out of the park and find a groove for customer acquisition/product market fit on a small scale.

4) In 12 months you should be making good money that covers the burn rate you've had over the past 9 months that helped calculate your seed round, but now you want to lock up the market. This is where the very purpose of venture capital comes in- you have a model that works and you want to grow + lock up the market.

5) Raise the money and grow in a calculated manner. Rounds beyond the Series A I won't cover here.

Hopefully this helps some. It's just one of many strategies to look at. To some it may make sense and to others it may be absolutely wrong.

</comment><comment><USER3> A pre-money valuation of 1m or 2m would imply that you are selling 33% or 20% of your company respectively in an equity financing.

At the level of investment you are talking about you may want to consider convertible debt rather than equity. Here is a good comparison of the two:

<http://venturehacks.com/articles/debt-or-equity>

Regarding control, things like board seats are negotiable and will largely depend on the type of investors you raise money from. Lots more on that topic here:

<http://venturehacks.com/archives#board-of-directors>

It sounds like you don't have any customers or revenue at this point. If you can get traction on one or both fronts before approaching investors you will likely increase both your chances of securing investment and your valuation.</comment>


Ask HN: Ideas on creating passive income streams - <AUTHOR> What are some ideas as developer where I can turn my skill into passive income. I write blogs but I'm not sure if its a good idea to monetize it <comment><USER2> I made a course on a small topic which is keyword research/SEO related and hosted on Udemy. It took me a week to create the whole thing since then I haven't done anything except answering a few questions of the students.

It's 99% passive. I am making around $150 per month.

This is the simple method I followed (CPSO)

Customer => Problem => Solution => Offer

1.) find a topic with enough interest (customer finding activity)

2.) identify a single problem in that topic (Problem finding activity)

3.) provide a clear cut solution to the problem Make sure they get a result by the end of it. Record your screen showing the solution without any fluff. (Solution providing activity)

4) Create a compelling offer and present to the customer (Make a compelling offer activity)

For the last part (offer), I created a video which is almost 45 minutes long and taught nearly 90% of the course. There's no need to buy if you watch the intro video which is free to preview on the course.

It's doing well.

Watch the preview video, and you are good to go—no need to buy it. But if you want to support an honest creator, then please consider purchasing the course using the following link. Many thanks.

[https://www.udemy.com/course/keyword-golden-ratio-formula- fi...](https://www.udemy.com/course/keyword-golden-ratio-formula-find-easy- keywords-to-rank-high-in-google/?couponCode=HACKER-NEWZ)

<comment><AUTHOR> The course looks very phenomenal I might buy it since SEO is really important as it gets you to the right audience

<comment><USER2> Thank you for your kind comments. I am looking forward to see you there.

</comment></comment></comment><comment><USER3> I'm a designer-turned-developer and created a nice-looking solitaire card game website: [https://online-solitaire.com/](https://online-solitaire.com/). It's making me around $1500 a month.

My approach was to find a nice of apps that where already popular and then see if I could make it better.

<comment><USER4> Any tips on becoming a developer turned designer? I'd be interested in that.

<comment><USER3> That's a tough one. One suggestion would be "don't". Most companies want either one or the other. I'm not a brilliant developer or a brilliant designer, which makes it hard for me to find my role in bigger companies.

On the other hand I can make things like [https://online- solitaire.com/](https://online-solitaire.com/) and [https://habitualapp.io/](https://habitualapp.io/) as a one-man operation.

<comment><AUTHOR> Honestly i love that Since as a one man operation you are owning the entire process compared to working for a company where things are done by other people too both have its pros and cons

</comment></comment></comment></comment><comment><USER5> What does passive income mean to you? Is it passive income when a YouTuber gets paid whenever someone views a video, but spends hundreds of hours making great content and building an audience? Is SaaS MRR passive income after you've spent hundreds or thousands of hours building a product and acquiring customers? Is it passive income when an author receives royalties after spending months writing, publishing, and marketing a book? Is advertising revenue passive income after you've spent hundreds of hours writing blog posts and building an audience?

If you want to leverage your time to make money when you sleep, you need to do the work to acquire income producing assets.

Here's some ways you could monetize your skills as a developer:

\- Provide value for free (blog posts, code, videos, whatever) to grow an audience, then sell courses or paid content to that audience.

\- Create open source software that other people need, then sell training videos on how to use it.

\- Build an audience for your blog, and join a developer/tech focused advertising network.

<comment><USER6> > _Create open source software that other people need, then sell training > videos on how to use it._

Please don't do this, I personally hate this motivation for Open Source development.

The incentive of the project developer is not aligned with the user. The developer has the incentive to make the software complex and unintuitive, so that people _require_ training to use it.

Any proposed changes to make the project easier to configure, threaten the income of the developer and will probably not be considered...

Monetisation is extremely hard to get right in open-source software.

<comment><USER5> Even better, don't write the software at all. Just sell training for popular open-source software. Could offer a cut of sales to developer in exchange for advertising the training on the GitHub.

</comment></comment></comment><comment><USER7> baseline suggestion for truly passive income is invest in the stock market: do dev work for people in exchange for money --> invest the money in the stock market (e.g. low cost passive index funds) --> expect roughly 5% real return on capital invested for long term buy & hold stock investment

<comment><AUTHOR> I have been thinking about it do you know how can i get started I'm just scared what if i make the wrong investment

<comment><USER8> Look into Financial Independence and 4% Safe withdrawal rate. Also look up lazy portfolio.

</comment></comment></comment><comment><USER9> build a dating app that doesn't charge for reading messages from other users.

Make it 1 dollar a month. let us talk to each other. Keep our profile there for years without us having to take an action. if somebody finds me and wants to talk to me - I want to get an email about it. I don't understand why such a simple app (browse, filter, message, get notifications) has to cost 10/15 bucks a month. make it 10 a year.

<comment><AUTHOR> I have seen people doing that but I'm afraid people below 18 might start using that

</comment></comment><comment><USER10> Sites like [https://www.indiehackers.com/interviews/page/1](https://www.indiehackers.com/interviews/page/1) are full of examples on what has been done. You can't do the same idea twice usually, but you can spot lots of patterns there.

</comment><comment><USER11> Figure out a way to make money from a hobby. It's not passive but it can be no net effort.

I like to make wordclocks. I like the process of figuring out better manufacturing processes. Some people buy them. Win win situation.

I don't sell many, but enough to pay for my cnc.

</comment><comment><USER12> Is selling something on Etsy ever a good idea? How to know if there is demand?

<comment><USER13> It can be. It's not passive income since you have to make and ship the items.

If you see other items similar to yours, then there is likely demand. If you don't, then you could experiment by making a few and listing them.

<comment><USER12> Thanks. I was thinking of selling wooden benches but would the shipping be ridiculous? Are there any shipping hacks to keep it affordable?

<comment><USER14> This shipping hack may apply, or it may not.

Search for a local warehouse that provides order fulfillment services and see if you can have them ship your benches.

A place like that ships enough packages they can usually get lower shipping rates than other businesses. I own a company like that in Ohio. With my rates it costs perhaps $30 to ship a gaming PC to California... for an individual it might cost $75.</comment></comment></comment></comment>


Mapping Out Your Web Startup - <AUTHOR> http://www.judegomila.com/2009/05/mapping-out-your-web-startup.html

<comment><USER2> i never thought i'd quote happy gilmore here but there's a scene where the pro golfers are trying to give him advice and he cuts them off and says "whoa you're confusing me. just let me put the ball in the hole."

if you're a small team, just make the best possible product. don't spread yourself too thin.

<comment><AUTHOR> Once you have this product how do you get users to come to use it? How do you keep users coming back? How do you make money from it. There are questions beyond making the best possible core product.

</comment></comment><comment><USER3> Great list. I would also add a box for 'Core Values'. It might help, for instance, in computing a more accurate valuation of 'Fear' as a trade object.

<comment><AUTHOR> Good idea. I'm going to superset fear with core values.

</comment></comment><comment><USER4> Thanks Jude, nice to see that ideas like yours are considered a good fit to startups. Much of my writing/thoughts are spent on optimizing efficiency (time/enthusiasm). Heckuva map, it hits on many of the "virtual landing points" that new businesses can setup to bring in customers/users. I was a little long winded/philosophical but did my best to describe some of the landing points here: [http://www.victusspiritus.com/2009/05/11/how-web- marketing-w...](http://www.victusspiritus.com/2009/05/11/how-web-marketing- will-effect-the-media-author-of-the-future/)

</comment><comment><USER5> I'm sorry but I didn't get a lot out of this diagram.

Is there supposed to be some kind of relationship or definition between either the boxes or the groups of boxes? To me it looks like a brainstorm of the facets of business put into little boxes and then grouped by topic area.

Is there some sort of structure beyond that? I mean, the boxes inside the "engines" aren't put into any special relationship with each other and the groups all have arrows pointing to the other groups. There's a "funnel" symbol, but then every large group has one, and it's not connected to anything to be funneled.

Perhaps it was so simple I missed it.

<comment><AUTHOR> See it more as a cheat sheet for possibilities that you may want to use. There are many possible combination and potential hook ups and compatibilities.

</comment></comment><comment><USER6> I think the "Core product" should be _slightly_ bigger/more important ;)

Nice diagram though.

<comment><AUTHOR> Thanks for the comment. The size on the map doesn't relate to importance. The map should be viewed in respect to the specific product your working on. The idea is to give more chart area to the interesting areas that are not talked about that much. Hope that clears that up.

<comment><USER6> Sure - not a criticism, just observation :) I guess it's the complement to "Make something people want" which basically only focuses on the product - this chart shows some of the other important things to think about.

<comment><AUTHOR> Would be nice to map out the core product part more....:>

<comment><USER7> Isn't that an exercise left to the reader?

</comment></comment></comment></comment></comment><comment><USER8> Excellent bulletin board material! A picture really can say a thousand words.

Also pretty eye opening. I've been spending 80% of my time in one box. I'll have to rethink my perspective. Thanks, Jude.

</comment><comment><USER9> awesome diagram, love it</comment>


Ask HN: How much time did it take you to build it? - <AUTHOR>

I'm interested in hearing from people who learned how to code because they were interested in developing one of their ideas. I'm at a point in the development of a Web application where my financial situation is preventing me from moving forward with it, and I'd like to make progress by learning how to code it myself. Is this at all feasible given that I know EXACTLY what I want to do with the Web application?<p>Can anyone give me advice on the best way to approach a scenario like this? Is there a way for me to scan through the books to find information relevant to my project? <comment><USER2> I am hands-on founder, and I've have done quite a bit of coding myself for the project, although I haven't actively coded since college and never made a living as a programmer. As a mediocre programmer, I can tell you: no matter how much you know exactly what you need to do, you will be shocked to find out how deep the rabbit hole really goes. That has been my experience, but I think it's true for a lot of non-coders.

The building blocks all seem to make sense. All information and tools you need to get started are out there. You think you are picking it up pretty fast going through all the tutorials online, but when it comes to actually fleshing out a feature or design, you get bogged down in minutia. Keeping the coding skills fresh takes constant practice. I started out erring by as much as 300% on the time estimates for some of the tasks I had to complete. I am now down to underestimating by about 50%, which is a huge improvement in 6 months, and as clear evidence as any that the ramp up is long and the learning curve is steep.

</comment><comment><USER3> I think you'll be surprised at how fast you can get something up. Just keep it really basic. Figure out the simplest thing you can do that will get people to sign up, build that, and then keep building more. Even if you build at an extremely slow rate, you can have something up relatively soon.

Start with a page that tells users what the site will do and collect email addresses while building the second part.

I coded in high school in 2003-2004 and stopped for 5 years or so. I came back and it took me about 1.5-2 months to build a full website that guides hs athletes through the recruitment process and builds them a profile. It took a lot of learning through errors and hours of trying to determine what was wrong only to find I was missing a semi-colon. Build with jquery & php. Now I feel as if the same project would only take me two weeks.

The more you code, the quicker it will become to build anything.

I built another website that helps you share what you're wearing and buy clothes through shopping api's. The core functions were built in about a week and a half and the rest of the time was spent perfecting the ui and building the graphic design.

</comment><comment><USER4> It depends on what you want to build. Keeping it simple helps.

I designed my last web site in about a month: dev time + learning an MVC framework (CakePHP), not working full time. Prior background of php web dev (non pro). Also, the framework has evolved, and a lot of things I had to do by myself at the time are now in the core.

In the end, what took me time is: back office stuff (end of day jobs, tracking user actions), design integration (we brought a designer in, though), UI (caching and ajax calls to speedup the site, and effects using scriptaculous), having our email platform good to go through spam filters.

Also, even when it seems straightforward, it takes more time than you may think. And coding is just the beginning.

tl;dr: Depends on your requirements and experience. Also, next time you'll be faster.

</comment><comment><USER5> How long have you been learning how to code? I can tell you right now that even though you know exactly what you want, you'll have to consider something called "dependencies" which is basically anything (technologies, libraries, or programming languages) you must do, learn, or build before you get what you want. I'm experiencing this right now learning to code and building something at the same time, and it's frustrating knowing a small feature takes a lot of work and figuring things out before working correctly.

As has been stated, get the simplest thing up and running, and iterate on that - using google and online communities as your guide.

Good luck!

<comment><USER6> Too true man. This is both a blessing and a curse. You have so many resources to choose from to help you, and yet, you have so many resources to weed through to know which one will help you. I always research before I try and reinvent the wheel. Unfortunately this can turn into procrastination and a drain on ones self to get the job done.

Personally I'm trying to get over doing it right the first time, and just getting it done so I can learn to do it right from my mistakes.</comment></comment>


AMC, Universal Agree to Trim Theatrical Window Before Movies Go Online - <AUTHOR> https://www.wsj.com/articles/amc-universal-agree-to-trim-theatrical-window-before-movies-go-online-11595968517 <comment><USER2> The days of the movie theaters are limited. With the pandemic the theaters are closed unless they bring back drive-ins. People are staying in their houses and would rather wait until the movies appear online sources to watch.

I got a stir crazy popcorn maker with a Super-Kist II butter topping same as the theater. We got a large screen TV and stereo surround. I used Amazon Prime for my movies and tv shows included with the price of Prime. Better than movie rentals because I don't have to worry about returning a movie. I get 48 hours before it expires.</comment>


Rise and Fall of a Hacker Who Found the Secrets of the Next Xbox and PlayStation - <AUTHOR> http://kotaku.com/5986239 <comment><USER2> > "I was treated like a criminal," he complained to me, looking back at the > raid.

Today we learn several lessons:

1) Don't break in to computers of American corporations while living in a country that has historically been very friendly with US law enforcement.

2) Don't break in to computers and boast about it to video game bloggers while using your real identity.

3) Pirating games and using stolen credit card numbers are both crimes, yes, but not doing them doesn't mean that breaking into computers isn't a crime.

4) If you don't want to be treated like a criminal, maybe don't commit crimes.

</comment><comment><USER3> When I read stuff like that, I just wonder what exactly the "hacked" company is trying to achieve, or if they have any idea themselves.

On one hand, you have a person who seems to genuinely care about the security of your company (since he gave you details), who had both the chance and the opportunity to use the access to leak stuff that could have been quite damaging to the company - yet didn't, and willfully meets the companies representatives and corporate enquirer.

On the other hand, you have a company who seems to have real problem with its security procedures, an improving but frail image as game platform (not so many dead xbox memes at the moment), and a way to manage problems like an elephant in a porcelain shop.

What exactly did anyone in his right mind hoped such a raid would do??? Let's see, for the potential "benefit" effects of frightening other hackers, it further damaged microsoft reputation and it will turn a cooperative hacker group into a revenge-seeking foe. What did they got??? In the day and age of cloud storage, what they took during the raid was at best zeroed harddrives previously containing a copy of the information they wanted that could now be anywhere - and they pissed off the guy who put that information out of they reach.

Strategically, all I see just looks like a terrible move.

Now think for a second - what if the guy puts everything he downloaded (sourcecode, etc) in a torrent, or pass the pdfs they were so willing to protect on wikileaks? What if he start using his knowledge to create not "giant hacks", but small hacks that could masquerade as bugs ? (say randomly turn off live access, hijack random xbox live accounts, etc)

What if he commits suicide ? After all, he said he lost everything! Seriously all this is at best a PR nightmare, and at worst the first step into a Sony PSN style catastrophy. Some people should be fired, they forgot the basic axiom :

DO NOT TAUNT THOSE WHO CAN DAMAGE YOU.

It will be fun watching anonymous attack xbox live in the following days, then the various bad things that will happen - no, not fun, sad. What will happen is so evident it's a tragedy.

Critics are easy, so I'll offer my 5 cents suggestion too. The right move in this case? Give the hackers a psychological assessment, a background check, then a big fat check to replace the bozos who were in charge of your security and failed. Give them more to loose- money, their dream job, reputation.

Just don't turn them into enemies who have nothing to lose.

<comment><USER4> > What exactly did anyone in his right mind hoped such a raid would achieve?

Made people think the company in question was doing what it needed to do to protect its users.

The group of people that would see that move as a negative is small. Gamers, by and large are not technically savvy people. They sat and worried about their characters being broken into and people cheating. Basically there is no action too drastic to protect them. The general public is basically the same. A 'hacker' did something, the company targeted brought the hammer down on him. All is well with the world.

Raid the hacker and nothing comes to light from what he did? The company protected its users. Raid and the material is released? This is why we have to be harder and harder on them until they get the message this won't be tolerated. Commits suicide? It just shows how unstable these people are.

<comment><USER5> > Made people think the company in question was doing what it needed to do to > protect its users.

So raiding hacker's houses is the IP equivalent of the TSA?

"Look at us, we're _doing_ something!"

</comment></comment></comment><comment><USER6> >Dylan's fellow hacker replies in detail about issues with the security of content on the Xbox Live Marketplace—the Xbox 360's online store—but doesn't elaborate on the Gamertag issue. The e-mail ends with a request for the Microsoft person to maybe put in a good word for them. "I don't mean to ask anything of you, and if I denied, I'll still be more than willing to help," Dylan's apparent hacker friend writes, "but do you think it would be possible that me and Dylan, if proved to be useful, could possibly list someone we've spoken to on your end as a reference for resumes or something of the sort?"

This part is puzzling to me. I think that at that point they had proved themselves capable enough to ask Microsoft to straight up hire/contract them, and not just for a resume quote. Establishing this kind of relationship with Microsoft could have also prevented the seizure.

>Dylan told me that he was polite and helpful during the raid, but that "they didn't allow me a lawyer...that's probably the biggest right they took from me."

Does anyone here know Australian law? I certainly don't but at first glance it looks like Dylan was intimidated into not doing what was legally the right thing.

<comment><USER7> I know of no jurisdiction where there's a right to legal representation _during_ a raid. This makes complete sense, because otherwise you could attempt to hold up a raid and dispose of evidence whilst you waited for your legal counsel to get there. Your can argue about what is and isn't admissible post the raid.

So I don't really think in that particular example any 'right' was taken from him.

</comment></comment><comment><USER8> It seems a bit far fetched that Microsoft has thousands of servers you can access publicly via default passwords.

They raided his home and took all of his stuff, but didn't arrest him? How is that legal? Shouldn't he get his stuff back if they don't have any case within X hours for prosecution?

I'm sure he's playing the victim here pretty hard because he states that he doesn't believe he has done anything wrong and yet has tried selling a Durango development kit on eBay in the past. He's probably done a lot more than that to prompt an FBI agent across the world to his doorstep.

<comment><USER2> This happened in Australia so it might be totally different, but if it happened in the US: a warrant for search and seizure of evidence requires less cause than a warrant for arrest, especially in the case where it's digital evidence that can be destroyed without a trace quite easily.

<comment><USER9> IANAL, but I believe they can seize the evidence if they have probable cause that a crime has been committed.

In this case it would be easy to establish probable cause given how open this guy has been with his hacking.

What I'm not sure of is how long its reasonable for the police to retain the seized equipment. Although the guy said he was unemployed, I think most IT people could make a case that the seizure of all computing equipment impedes their ability to earn a living. That doesnt seem fair if no charge s have been laid.

</comment></comment></comment><comment><USER10> Devkits are, usually, property of the console manufacturer. Maybe things has changed with the new Xbox but this how it was in 6th and 7th generations.

If the ownership of devkits remains at MS then somebody who has one without MS authorization is in possession of stolen property, this answers the question "what did I do wrong?".

</comment><comment><USER11> He's unemployed because he has 'chronic pain' thus is unable to work but he can spend all his time hacking game development companies? I call bullshit. I don't know his situation but I wouldn't be surprised he's collecting a welfare cheque too considering how easy this is to do in Australia.

(Don't get me wrong I have nothing against people on welfare - Ive been a beneficiary when I was growing up but he sounds like the kind of person who choses not to work and will use any excuse not to.)</comment>


Newspaper company launches its own Android tablet - <AUTHOR> http://technicallyphilly.com/2011/09/13/philadelphia-media-network-android-tablet-arnova-10-g2-hands-on-video#more-13540

<comment><USER2> This will end well. Newspapers have ALWAYS been the bastian of technological innovation, especially with proprietary products. Why I remember Delphi, CD-I, "download a PDF of our Quark Files!," and hell, the BBS I ran for one.

60 year old newspaper editor says "a tablet cost as much as our annual subscription" and somehow that leads to this, rather than maybe reevaluating the cost of their subscription.

</comment><comment><USER3> It's great to see Newspaper industry trying something different. I don't know if this will save them but innovation is almost always the step in the right direction.</comment>


Binary operators – a basic intro using Arduino - <AUTHOR> http://rluckom.github.io/

<comment><USER2> _I find myself thinking more carefully about how data is actually represented in a computer_

Such a shame then that the Arduino helpers have managed to conceal that.

On the 8-bit AVR architecture, you can of course just assign your counter variable directly to the memory-mapped pin output register and don't have to deal with them on a per-bit basis. You can even omit the counter altogether and just use the pin output register.

<comment><USER3> Why is that a shame? If that were the case then some poor 9 year old wouldn't be able to get the blinken lights to work without help from the parents.</comment></comment>


Systemd, 10 years later: a historical and technical retrospective - <AUTHOR> https://blog.darknedgy.net/technology/2020/05/02/0/index.html <comment><USER2> This was already posted 12 days go: [https://news.ycombinator.com/item?id=23062072](https://news.ycombinator.com/item?id=23062072)

</comment><comment><USER3> The problem is the almost complete lack of documentation and all around knowledge. They have thrown out the baby with the bathwater even when there was no need to do so.

Example: [https://www.google.com/search?q=%22systemd.timer%22](https://www.google.com/search?q=%22systemd.timer%22) vs [https://www.google.com/search?q=%22crontab%22&](https://www.google.com/search?q=%22crontab%22&)

Or [https://www.google.com/search?q=%22systemd- networkd%22](https://www.google.com/search?q=%22systemd-networkd%22)

All of this is fundamental stuff and decades of practice has been thrown away and it's not clear at all whether keeping backwards compatibility would've been so impossible.</comment>


Apple's "real" earnings grew a staggering 124.6% in Q4 - <AUTHOR> http://www.appleinsider.com/articles/08/10/23/apples_real_earnings_grew_a_staggering_124_6_in_q4.html <comment><USER2>
      "This should infuriate the informed investor because it
      means that Apple is quite literally trading on P/E ratios
      that do not reflect more than half of its business."

Yawn. No, it should -excite- informed investors because there's a tremendous opportunity to buy really cheap Apple stock from uninformed investors who don't know Apple's true earnings.

Unless, of course, the world economy collapses and demand for expensive consumer goods dries up.

<comment><USER3> Yeah - Apple at a PE of 7 (when you net out the cash) is an amazing buy - assuming the economy doesn't collapse completely.

</comment></comment><comment><USER4> Thats a significant success by any measure, especially considering its in billions of dollars.

</comment><comment><USER5> and im about to buy a macbook - so it will jump even more :)</comment>